[PATCH 3/4] libvirt: Introduce virDomainReloadTlsCertificates API
Zheng Yan
yanzheng759 at huawei.com
Tue May 11 14:05:20 UTC 2021
The new virDomainReloadTlsCertificates API is used to notify domain reload
its certificates without restart, and avoid service interruption.
And add remote qemu driver impl for virDrvDomainReloadTlsCertificates.
Currently, only QEMU VNC TLS certificates are supported, but parameters and
flags are also reserved for subsequent scenarios.
Take reload QEMU VNC TLS certificates as an example, we can call:
virDomainReloadTlsCertificates(domain,
VIR_DOMAIN_TLS_CERT_GRAPHICS_VNC,
NULL, 0, 0);
Then the specified QMP message would be send to QEMU:
{"execute": "display-relo "arguments":{"type": "vnc", "tls-certs": true}}
Signed-off-by: Zheng Yan <yanzheng759 at huawei.com>
---
include/libvirt/libvirt-domain.h | 20 +++++++++++
src/libvirt-domain.c | 57 ++++++++++++++++++++++++++++++++
src/libvirt_public.syms | 5 +++
src/remote/remote_driver.c | 1 +
src/remote/remote_protocol.x | 15 ++++++++-
src/remote_protocol-structs | 10 ++++++
6 files changed, 107 insertions(+), 1 deletion(-)
diff --git a/include/libvirt/libvirt-domain.h b/include/libvirt/libvirt-domain.h
index e99bfb7654..357d3598a6 100644
--- a/include/libvirt/libvirt-domain.h
+++ b/include/libvirt/libvirt-domain.h
@@ -5152,4 +5152,24 @@ int virDomainStartDirtyRateCalc(virDomainPtr domain,
int seconds,
unsigned int flags);
+/**
+ * virDomainTlsCertificateType:
+ * the used scene of TLS certificates for doamin
+ */
+typedef enum {
+ VIR_DOMAIN_TLS_CERT_GRAPHICS_VNC = 0,
+ VIR_DOMAIN_TLS_CERT_GRAPHICS_SPICE = 1,
+
+# ifdef VIR_ENUM_SENTINELS
+ VIR_DOMAIN_TLS_CERT_LAST
+# endif
+} virDomainTlsCertificateType;
+
+int
+virDomainReloadTlsCertificates(virDomainPtr domain,
+ unsigned int type,
+ virTypedParameterPtr params,
+ int nparams,
+ unsigned int flags);
+
#endif /* LIBVIRT_DOMAIN_H */
diff --git a/src/libvirt-domain.c b/src/libvirt-domain.c
index 42c75f6cc5..f2a8949971 100644
--- a/src/libvirt-domain.c
+++ b/src/libvirt-domain.c
@@ -13218,3 +13218,60 @@ virDomainStartDirtyRateCalc(virDomainPtr domain,
virDispatchError(conn);
return -1;
}
+
+/**
+ * virDomainReloadTlsCertificates:
+ * @domain: a domain object.
+ * @type: a value of virDomainTlsCertificateType
+ * @params: pointer to TLS Certs parameter objects, must be NULL if not used
+ * @nparams: number of TLS Certs parameter objects, must be 0 if not used
+ * @flags: extra flags; not used yet, so callers should always pass 0
+ *
+ * Notify domain reload its certificates with specified 'type'
+ *
+ * Returns 0 in case of success, -1 otherwise.
+ */
+int
+virDomainReloadTlsCertificates(virDomainPtr domain,
+ unsigned int type,
+ virTypedParameterPtr params,
+ int nparams,
+ unsigned int flags)
+{
+ virConnectPtr conn;
+
+ VIR_DOMAIN_DEBUG(domain, "certificate type=%u, params=%p, nparams=%d, flags=%x",
+ type, params, nparams, flags);
+
+ virResetLastError();
+
+ virCheckDomainReturn(domain, -1);
+ conn = domain->conn;
+ virCheckReadOnlyGoto(conn->flags, error);
+ virCheckNonNegativeArgGoto(nparams, error);
+
+ if (type >= VIR_DOMAIN_TLS_CERT_LAST) {
+ virReportInvalidArg(type,
+ _("type must be less than %d"),
+ VIR_DOMAIN_TLS_CERT_LAST);
+ goto error;
+ }
+
+ if (conn->driver->domainReloadTlsCertificates) {
+ int ret;
+ ret = conn->driver->domainReloadTlsCertificates(domain,
+ type,
+ params,
+ nparams,
+ flags);
+ if (ret < 0)
+ goto error;
+ return ret;
+ }
+
+ virReportUnsupportedError();
+
+ error:
+ virDispatchError(domain->conn);
+ return -1;
+}
diff --git a/src/libvirt_public.syms b/src/libvirt_public.syms
index 5678a13cda..30ff012958 100644
--- a/src/libvirt_public.syms
+++ b/src/libvirt_public.syms
@@ -896,4 +896,9 @@ LIBVIRT_7.3.0 {
virNodeDeviceCreate;
} LIBVIRT_7.2.0;
+LIBVIRT_7.4.0 {
+ global:
+ virDomainReloadTlsCertificates;
+} LIBVIRT_7.3.0;
+
# .... define new API here using predicted next version number ....
diff --git a/src/remote/remote_driver.c b/src/remote/remote_driver.c
index 0c72d69933..0e6e4e3007 100644
--- a/src/remote/remote_driver.c
+++ b/src/remote/remote_driver.c
@@ -8566,6 +8566,7 @@ static virHypervisorDriver hypervisor_driver = {
.domainAuthorizedSSHKeysSet = remoteDomainAuthorizedSSHKeysSet, /* 6.10.0 */
.domainGetMessages = remoteDomainGetMessages, /* 7.1.0 */
.domainStartDirtyRateCalc = remoteDomainStartDirtyRateCalc, /* 7.2.0 */
+ .domainReloadTlsCertificates = remoteDomainReloadTlsCertificates, /* 7.4.0 */
};
static virNetworkDriver network_driver = {
diff --git a/src/remote/remote_protocol.x b/src/remote/remote_protocol.x
index de69704b68..96cc7dd9ea 100644
--- a/src/remote/remote_protocol.x
+++ b/src/remote/remote_protocol.x
@@ -286,6 +286,8 @@ const REMOTE_DOMAIN_AUTHORIZED_SSH_KEYS_MAX = 2048;
/* Upper limit on number of messages */
const REMOTE_DOMAIN_MESSAGES_MAX = 2048;
+/* Upper limit on list of TLS certificate parameters */
+const REMOTE_DOMAIN_RELOAD_TLS_CERT_PARAMETERS_MAX = 16;
/* UUID. VIR_UUID_BUFLEN definition comes from libvirt.h */
typedef opaque remote_uuid[VIR_UUID_BUFLEN];
@@ -3836,6 +3838,12 @@ struct remote_domain_start_dirty_rate_calc_args {
unsigned int flags;
};
+struct remote_domain_reload_tls_certificates_args {
+ remote_nonnull_domain dom;
+ unsigned int type;
+ remote_typed_param params<REMOTE_DOMAIN_RELOAD_TLS_CERT_PARAMETERS_MAX>;
+ unsigned int flags;
+};
/*----- Protocol. -----*/
@@ -6784,6 +6792,11 @@ enum remote_procedure {
* @priority: high
* @acl: node_device:start
*/
- REMOTE_PROC_NODE_DEVICE_CREATE = 430
+ REMOTE_PROC_NODE_DEVICE_CREATE = 430,
+ /**
+ * @generate: both
+ * @acl: domain:write
+ */
+ REMOTE_PROC_DOMAIN_RELOAD_TLS_CERTIFICATES = 431
};
diff --git a/src/remote_protocol-structs b/src/remote_protocol-structs
index 6b46328adc..799a8596ea 100644
--- a/src/remote_protocol-structs
+++ b/src/remote_protocol-structs
@@ -3192,6 +3192,15 @@ struct remote_domain_start_dirty_rate_calc_args {
int seconds;
u_int flags;
};
+struct remote_domain_reload_tls_certificates_args {
+ remote_nonnull_domain dom;
+ u_int type;
+ struct {
+ u_int params_len;
+ remote_typed_param * params_val;
+ } params;
+ u_int flags;
+};
enum remote_procedure {
REMOTE_PROC_CONNECT_OPEN = 1,
REMOTE_PROC_CONNECT_CLOSE = 2,
@@ -3623,4 +3632,5 @@ enum remote_procedure {
REMOTE_PROC_NODE_DEVICE_DEFINE_XML = 428,
REMOTE_PROC_NODE_DEVICE_UNDEFINE = 429,
REMOTE_PROC_NODE_DEVICE_CREATE = 430,
+ REMOTE_PROC_DOMAIN_RELOAD_TLS_CERTIFICATES = 431,
};
--
2.25.1
More information about the libvir-list
mailing list